CVE-2026-42945 Exploit Metadata

PoC files

19 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Analysisdeepseek-v4-pro:cloud · 2026-08-08

Technical assessment

The artifact is a test suite and build pipeline for a patched nginx container image. It includes a regression test (test_cve_2026_42945.py) that sends crafted HTTP requests to exercise the vulnerable code path and validates the worker process does not crash or produce corrupted output, but it does not contain code to achieve code execution or gain unauthorized access. The primary operation is validating the presence and effectiveness of a backported patch, not exploiting the vulnerability.

Backdoor review

No backdoor observed in reviewed code

The reviewed evidence consists of a Makefile, README, provenance JSON, and a Python regression test for a backported CVE-2026-42945 fix in nginx. All files describe and implement legitimate vulnerability remediation, testing, and documentation. No concealed executable behavior, deceptive payloads, or operator-directed harm is present.

ClassificationScanner

Model confidence95%

AuthenticationNot required

LanguagesPythonShellMakefile

Target softwarenginx

Attack typesHeap-based Buffer Overflow

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The artifact's primary stated purpose is to validate a backported security patch, not to exploit the vulnerability. The test script explicitly states it 'does not weaponize the overflow into RCE' and 'does not prove memory safety via instrumentation'. It checks for crashes and response integrity, which is characteristic of a scanner/validator, not an exploit.

test/test_cve_2026_42945.py:24-28test/test_cve_2026_42945.py:2-8

Requirements

A running instance of the patched nginx container image with the regression test configuration loaded.test/test_cve_2026_42945.py:44-45test/test_cve_2026_42945.py:203-210

Observed behavior

Starts a Docker container running the patched nginx image with a custom configuration containing rewrite rules that manipulate query strings.test/test_cve_2026_42945.py:203-210
Sends HTTP GET requests to endpoints designed to trigger the vulnerable code path, including requests with query string manipulation, chained rewrites, and long query strings.test/test_cve_2026_42945.py:240-245test/test_cve_2026_42945.py:287test/test_cve_2026_42945.py:330-336
Checks HTTP response status codes, Location headers, and response bodies for signs of corruption (e.g., null bytes, overlong headers) or worker crashes.test/test_cve_2026_42945.py:247-271test/test_cve_2026_42945.py:338-362
Sends 100 rapid, mixed requests to detect intermittent worker crashes and validates the worker process survives.test/test_cve_2026_42945.py:368-402
Reports a pass/fail summary based on whether the worker remained stable and responses were well-formed, indicating the patch is functional.test/test_cve_2026_42945.py:430-442

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Cve Remediation: CVE-2026-42945The artifact is a source-built nginx container image that backports a one-line fix for a heap buffer overflow in ngx_http_rewrite_module. The README and provenance JSON document the patch derivation, build verification, and regression testing.README.md:191-273build/patches/CVE-2026-42945.provenance.json:1-50
Regression Test: test/test_cve_2026_42945.pyA Python test script that exercises the vulnerable code path by sending crafted HTTP requests to a containerized nginx instance. It validates correct behavior and absence of crashes, which is normal exploit testing for a security fix.test/test_cve_2026_42945.py:1-446
Build Pipeline: Makefile targets for build, test, scan, and VEX generationThe Makefile orchestrates building the patched nginx image, running compatibility and regression tests, and performing vulnerability scanning with VEX suppression. All targets are standard for a CVE remediation project.Makefile:1-91

Review boundaries

What the analysis did not establish

The evidence does not include the actual patch file (build/patches/CVE-2026-42945.patch) or the build scripts (build/build.sh, build/verify-patch.sh), only their descriptions in README.md and provenance metadata.
The analysis is based on static review of the provided text files; the code was not executed, and its behavior in a live environment is not confirmed.
The artifact's complete_artifact_coverage is false, indicating 15 files were omitted from the evidence packet, which may contain additional relevant code.
15 files in the repository were not analyzed (binary policy: FLAGGED_METADATA_ONLY_NOT_ANALYZED). Their content is unknown, but they are not part of the selected text evidence.
The review is limited to the supplied text files; no dynamic analysis or execution was performed.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

GitHub

build

Created 2026-05-16Vuln labNo linked CVEDockerfile

1 Dockerfile

Analysisdeepseek-v4-pro:cloud · 2026-08-06

Environment assessment

A source-built nginx 1.25.5 container image that remediates CVE-2024-6119 and CVE-2026-42945, serving as a vulnerability research and remediation demonstration lab.

README.md:1-3

Lab assessment

Vulnerability lab

The README explicitly states the project remediates two CVEs, describes the vulnerability details, patch provenance, regression testing, and scanner verification, which are all characteristics of a vulnerability research and reproduction environment.

README.md:1-3README.md:5-10

Lab shapeDockerfile

ServicesUnknown

Compose manifests0

Dockerfiles1

Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries

Components

Services and files described by the evidence

Builder image

compilation environment

A Debian Bookworm Slim image with build tools and libraries installed to compile nginx from source.

build/Dockerfile.build:1-28

build.sh

build orchestratorpatch applicatorpackage builder

Fetches nginx and NJS source tarballs, verifies SHA256, applies the CVE-2026-42945 patch, compiles nginx with upstream flags, builds dynamic modules, and packages everything into a .deb file.

build/build.sh:1-925

generate-vex.sh

VEX document generator

Generates an OpenVEX v0.2.0 document for CVE-2026-42945 to suppress scanner findings for the backported fix.

build/generate-vex.sh:1-68

verify-patch.sh

patch provenance verifier

Downloads upstream nginx tarballs, verifies integrity, and demonstrates that the committed patch is the minimal security-relevant diff between versions.

build/verify-patch.sh:1-150

CVE-2026-42945.patch

security patch

The backported one-line fix for CVE-2026-42945, derived from the diff between nginx 1.25.5 and 1.30.1.

README.md:155-157

CVE-2026-42945.provenance.json

provenance metadata

Machine-readable metadata documenting the patch derivation, source hashes, and fix details.

README.md:160

Exercise context

Requirements and sequence described by the evidence

Prerequisites

Docker must be installed to build and run the images.README.md:47
The builder image (build/Dockerfile.build) must be built first to provide the compilation environment.build/Dockerfile.build:1-28
The build process requires network access to fetch source tarballs from nginx.org and GitHub.build/build.sh:33build/build.sh:40

Evidence-described exercise path

Build the builder image using build/Dockerfile.build.build/Dockerfile.build:1-28
Run build.sh inside the builder container to fetch, patch, compile, and package nginx.build/build.sh:1-925
Build the final runtime image using the Containerfile (not included in evidence) that installs the .deb.README.md:47
Run compatibility tests (make test) to verify behavior matches the official nginx image.README.md:50
Run the CVE-2026-42945 regression test (make test-cve) to exercise the vulnerable code path.README.md:53
Verify patch provenance (make verify-patch) by re-deriving the patch from upstream tarballs.README.md:56
Scan the fixed image with and without VEX (make scan) to demonstrate scanner behavior.README.md:59

Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at building a patched nginx image, verifying the fix, and demonstrating scanner interactions within the lab's own containerized environment. There is no evidence of host escape, external connections beyond fetching source tarballs, persistence, credential theft, or destructive actions.

build/build.sh:1-925build/generate-vex.sh:1-68build/verify-patch.sh:1-150

Review boundaries

What the analysis did not establish

The Containerfile for the final runtime image is not included in the evidence packet.
The Makefile referenced in the README is not included.
The test scripts (compat.py, test_cve_2026_42945.py) are not included.
The patch file and provenance JSON are listed in the file inventory but their content is not provided as evidence text.
The unit_cve_ids array is empty, so no CVE assessments are performed despite the README discussing CVE-2024-6119 and CVE-2026-42945.

Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

GitHub

Repository root

Created 2026-05-16Vuln labCVE-2023-2953 CVE-2023-44487 CVE-2023-5678 CVE-2023-6129 CVE-2023-6237 CVE-2024-2511 CVE-2024-4741 CVE-2024-5535 CVE-2024-6119 CVE-2024-9143 CVE-2025-15467 CVE-2025-6297 CVE-2025-69420 CVE-2025-69720 CVE-2026-2219 CVE-2026-33845 CVE-2026-42010 CVE-2026-42945 CVE-2026-4437 CVE-2026-5435 CVE-2026-5450 CVE-2026-5773 CVE-2026-5928 CVE-2026-6276Dockerfile

1 Dockerfile

Analysisdeepseek-v4-pro:cloud · 2026-08-06

Environment assessment

A source-built nginx 1.25.5 container image that remediates CVE-2024-6119 (OpenSSL version bump) and CVE-2026-42945 (backported source patch) while preserving upstream runtime behavior. The environment includes a Dockerfile, build scripts, patch files, regression tests, compatibility tests, and VEX generation scripts.

README.md:1-4Containerfile:1-84

Lab assessment

Vulnerability lab

The README explicitly states the project remediates two CVEs (CVE-2024-6119 and CVE-2026-42945) and provides a test suite, patch provenance, and VEX generation to demonstrate the fixes. The Containerfile builds a custom nginx image with these remediations.

README.md:1-4README.md:7-10

Lab shapeDockerfile

ServicesUnknown

Compose manifests0

Dockerfiles1

Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries

Components

Services and files described by the evidence

Containerfile

runtime image definition

Defines the final nginx image based on debian:bookworm-slim, installs a custom-built .deb package, copies entrypoint scripts from the upstream nginx:1.25-bookworm image, and sets up log symlinks.

Containerfile:1-84

build/build.sh

build scriptpatch applicationcompilationpackaging

Fetches nginx and NJS source tarballs with SHA256 verification, applies the CVE-2026-42945 patch, compiles nginx with upstream-identical configure flags, builds dynamic modules and debug binaries, and assembles a .deb package.

build/build.sh:1-925

build/patches/CVE-2026-42945.patch

security patch

A one-line backported fix for CVE-2026-42945 that resets e->is_args in ngx_http_script_regex_end_code().

README.md:201-204

build/verify-patch.sh

patch provenance verification

Downloads upstream nginx source tarballs, verifies their integrity, generates a diff, and confirms the committed patch applies cleanly and matches the upstream fix.

build/verify-patch.sh:1-150

build/generate-vex.sh

VEX document generation

Generates an OpenVEX v0.2.0 document declaring CVE-2026-42945 as fixed via backported patch, for use with vulnerability scanners.

build/generate-vex.sh:1-68

test/test_cve_2026_42945.py

regression test

Starts a container with a custom nginx config that exercises the vulnerable rewrite code path, sends HTTP requests that manipulate query string state, and asserts no crashes, buffer overflows, or malformed responses occur.

test/test_cve_2026_42945.py:1-446

test/compat.py

compatibility test

Boots both the baseline nginx:1.25-bookworm and the candidate fixed image, and compares image metadata, nginx -V output, dynamic modules, filesystem layout, HTTP responses, TLS termination, graceful shutdown, config reload, and concurrent request handling.

Insufficient evidence

Listed in the README residual risk table as a vulnerability in curl/libcurl4 with status 'Won't fix'. No evidence of active remediation or exploitation is provided.

README.md:460-461

Exercise context

Requirements and sequence described by the evidence

Prerequisites

Docker must be installed and running to build the image and execute the test suites.README.md:53-55test/test_cve_2026_42945.py:180-185test/compat.py:1
The build script requires network access to download nginx and NJS source tarballs from nginx.org and github.com.build/build.sh:30-35build/build.sh:40-45
The verification script requires network access to download upstream nginx source tarballs.build/verify-patch.sh:30-35
The compatibility test requires the baseline image nginx:1.25-bookworm to be available locally or pulled from a registry.test/compat.py:40-41

Evidence-described exercise path

Build the fixed nginx image using 'make image' or by running the Containerfile with the build context.README.md:53-55
Run the compatibility test suite with 'make test' to verify the fixed image behaves identically to the upstream image.README.md:56-57
Run the CVE-2026-42945 regression test with 'make test-cve' to exercise the vulnerable code path and confirm the patch prevents crashes and buffer overflows.README.md:59-60
Verify patch provenance with 'make verify-patch' to independently re-derive the patch from upstream tarballs.README.md:62-63
Scan the fixed image and demonstrate VEX suppression with 'make scan'.README.md:65-66

Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at building, testing, and verifying a patched nginx container image within the lab's own scope. The Containerfile, build scripts, and test suites do not contain any instructions that escape the container boundary, persist data outside the lab, steal credentials, or connect to external systems beyond documented source downloads. The regression test starts a container with a custom config and sends HTTP requests to localhost; the compatibility test compares two local containers. No hidden or unnecessary host compromise is evident.

Containerfile:1-84build/build.sh:1-925test/test_cve_2026_42945.py:1-446test/compat.py:1-930

Review boundaries

What the analysis did not establish

The packet does not include the Makefile, Dockerfile.build, patch files, or scanner output files referenced in the README, so their exact content cannot be verified.
The .deb package and compiled binaries are not included; their behavior is not inspected.
The VEX generation script references a docker inspect command that interacts with the Docker daemon, but this is a standard operation for obtaining image metadata and does not indicate malicious intent.
The compatibility test and regression test both start and stop Docker containers, which requires access to the Docker socket. This is a common requirement for containerized test environments and is not inherently suspicious.

Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

CVE-2026-42945